[Docker] Docker Registry 인증서 설정

• Docker Registry에 주소를 지정하고 이 주소를 사용하기 위해서 https 설정(SSL 설정)을 해줘야 한다.
• 이를 진행하는 방법은 두 가지 (1) certbot을 사용 (2) openssl을 사용한다. 

  [1] certbot 사용  

    실제 사용 방법

# Nginx 설정

2022.01.17 - [DevOps & Infra/Nginx] - [Nginx] Ubuntu 서버에 Nginx 설치하기

[Nginx] Ubuntu 서버에 Nginx 설치하기

 

# Certbot 설정

2022.06.22 - [DevOps & Infra/Nginx] - [Nginx] SSL 설정하기

[Nginx] SSL 설정하기

 

  [2] openssl 사용  

• RSA 키 생성

  $ openssl genrsa -out .org.key 2048

  > Generating RSA private key, 2048 bit long modulus (2 primes)
  ..+++++
  ....................................................................................+++++
  e is 65537 (0x010001)
  .
  .
  .

 

• CSR 생성

$ openssl req -new -key .org.key -out .org.csr

> Can't load /home/ubuntu/.rnd into RNG
140065004007872:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/home/ubuntu/.rnd
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:KO
State or Province Name (full name) [Some-State]:Seoul
Locality Name (eg, city) []:Seoul
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:.org
Email Address []:jamie919@.org

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

 

• CRT 인증서 파일 생성

openssl x509 -req -days 365 -signkey -signkey org.key -out org.crt

 

• 생성한 인증서를 이용해 registry 컨테이너를 올린다.

  $ docker run -it -d \
  	-e REGISTRY_HTTP_ADDR=127.0.0.1:5000 \
    -e REGISTRY_HTTP_TLS_CERTIFICATE=./org.crt \
    -e REGISTRY_HTTP_TLS_KEY=./org.key
    -p 5000:5000
    --name docker-registry registry